Discrete optimal transport is a strong audio adversarial attack

2025/09/18 by Anton Selitskiy, Selitskiy, Anton, Akib Shahriyar +3
Computer Science · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Audio and Speech Processing (eess.AS) #FOS: Computer and information sciences #FOS: Electrical engineering #Hate Speech and Cyberbullying Detection #Speech Recognition and Synthesis #electronic engineering #information engineering

paper · pdf · doi:10.48550/arxiv.2509.14959

openalex publication_date 2025/09/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

In this paper, we investigate discrete optimal transport (DOT) as a black-box attack against modern automatic speaker verification (ASV) and anti-spoofing countermeasure (CM) systems. Our attack operates as a post-processing distribution-alignment step. Frame-level WavLM embeddings of generated speech (or another person speech) are aligned to an unpaired bona fide speech pool using entropic optimal transport and a top-k barycentric projection, followed by neural vocoding. Unlike gradient-based attacks, the proposed method requires no access to model parameters, gradients, or training data. Experiments on ASVspoof2019 and ASVspoof5 demonstrate that DOT attack substantially increases CM EER and substantially degrades ASV performance across multiple spoofing attacks. The attack transfers across datasets and remains effective after CM fine-tuning. Analysis using speaker similarity, Fréchet Audio Distance, and visualization of embedding distributions suggests that DOT succeeds by shifting source speech toward bona fide regions of the representation space rather than by maximizing speaker similarity. These results indicate that optimal-transport-based distribution alignment represents a previously underexplored attack vector for contemporary ASV and anti-spoofing systems.

Citations

• Training-Free Voice Conversion with Factorized Optimal Transport
• Discrete Optimal Transport and Voice Conversion
• ASVspoof 5: Design, Collection and Validation of Resources for Spoofing, Deepfake, and Adversarial Attack Detection Using Crowdsourced Speech
• ASVspoof 5: Design, collection and validation of resources for spoofing, deepfake, and adversarial attack detection using crowdsourced speech
• Optimal Transport Maps are Good Voice Converters
• The T05 System for The VoiceMOS Challenge 2024: Transfer Learning from Deep Image Classifier to Naturalness MOS Prediction of High-Quality Synthetic Speech
• Adapting Frechet Audio Distance for Generative Music Evaluation
• Malafide: a novel adversarial convolutive noise attack against deepfake and spoofing detection systems
• Voice Conversion With Just Nearest Neighbors
• Multisample Flow Matching: Straightening Flows with Minibatch Couplings
• WavLM: Large-Scale Self-Supervised Pre-Training for Full Stack Speech Processing
• AASIST: Audio Anti-Spoofing using Integrated Spectro-Temporal Graph Attention Networks
• ASVspoof 2019: A large-scale public database of synthesized, converted and replayed speech
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• CNN Architectures for Large-Scale Audio Classification
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks

Related

• Towards Robust Speech-to-Text Adversarial Attack
• Augmentation through Laundering Attacks for Audio Spoof Detection
• Decoding Deception: Understanding Automatic Speech Recognition Vulnerabilities in Evasion and Poisoning Attacks
• A Study On Data Augmentation In Voice Anti-Spoofing
• Malafide: a novel adversarial convolutive noise attack against deepfake and spoofing detection systems